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ERIN  E.  SCHNEIDER  (Cal.  Bar  No.  216114) 

TRACY  L.  DAVIS  (Cal.  Bar  No.  184129) 
davistl@sec.gov 

ROBERT  L.  TASHJIAN  (Cal.  Bar  No.  191007) 
tashj  ianr@sec .  gov 

MATTHEW  G.  MEYERHOFER  (Cal.  Bar  No.  268559) 
meyerhoferm@sec .  gov 

Attorneys  for  Plaintiff 

SECURITIES  AND  EXCHANGE  COMMISSION 
44  Montgomery  Street,  Suite  2800 
San  Francisco,  CA  94104 
(415)  705-2500 


UNITED  STATES  DISTRICT  COURT 
NORTHERN  DISTRICT  OF  CALIFORNIA 


SECURITIES  AND  EXCHANGE  COMMISSION, 


Case  No. 


Plaintiff, 

vs. 


COMPLAINT 


FACEBOOK,  INC. 

Defendant. 


Plaintiff  Securities  and  Exchange  Commission  (the  “Commission”)  alleges: 

SUMMARY  OF  THE  ACTION 

1 .  For  more  than  two  years,  Facebook  made  misleading  statements  in  its  required 
public  filings  about  the  misuse  of  its  users’  data.  From  2016  until  mid-March  2018,  Facebook 
presented  the  risk  of  misuse  of  its  users’  data  as  merely  hypothetical.  In  fact,  Facebook  had 
already  become  aware  by  December  2015  that  a  researcher  had  improperly  sold  information 
related  to  tens  of  millions  of  Facebook  users  to  data  analytics  firm  Cambridge  Analytica. 

2.  Since  its  initial  public  offering  in  2012,  Facebook  has  warned  investors  that  one 
of  the  material  risks  to  its  business  was  the  fact  that  independent  developers  who  create 

applications  for  its  platform  might  misuse  personal  data  obtained  from  Facebook  users. 
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3.  In  June  2014,  an  academic  researcher  and  Cambridge  Analytica  entered  into  an 
agreement,  through  affiliated  companies,  whereby  Cambridge  Analytica  would  pay  for  the 
researcher  to  collect  data  on  Facebook  users.  At  Cambridge  Analytical  expense,  the  researcher 
developed  a  personality  survey  that  obtained  data  from  U.S.  Facebook  users,  including  their 
names,  birthdates,  gender,  location,  and  their  affinities,  or  “page  likes.”  From  the  summer  of 
2014  through  the  spring  of  2015,  the  researcher  transferred  data  relating  to  approximately 

30  million  Facebook  users  in  the  United  States  to  Cambridge  Analytica. 

4.  Facebook  learned  about  the  collaboration  between  the  researcher  and  Cambridge 
Analytica  when  it  investigated  a  report  published  in  the  British  press  in  December  2015.  Within 
days  of  the  press  report,  both  the  researcher  and  Cambridge  Analytica  privately  confirmed  to 
Facebook  that  the  researcher  had  transferred  personality  profiles  based  on  Facebook  user  data  to 
Cambridge  Analytica.  Facebook  determined  that  the  transfer  violated  its  policy  that  prohibits 
developers,  like  the  researcher,  from  selling  or  transferring  its  users’  data,  and  told  the  researcher 
and  Cambridge  Analytica  to  delete  the  data. 

5 .  In  June  20 1 6,  the  researcher  told  Facebook  that,  in  addition  to  transferring 
Cambridge  Analytica  personality  profiles  for  approximately  30  million  of  its  users,  he  had  also, 
for  those  same  users,  sold  Cambridge  a  substantial  quantity  of  the  underlying  Facebook  data 
from  which  he  had  derived  those  profiles. 

6.  In  its  quarterly  and  annual  reports  filed  between  January  28,  2016  and  March  16, 
2018  (the  “relevant  period”),  Facebook  did  not  disclose  that  a  researcher  had,  in  violation  of  the 
company’s  policies,  transferred  data  relating  to  approximately  30  million  Facebook  users  to 
Cambridge  Analytica.  Instead,  Facebook  misleadingly  presented  the  potential  for  misuse  of  user 
data  as  merely  a  hypothetical  investment  risk.  Moreover,  when  asked  by  reporters  in  2017  about 
its  investigation  into  the  Cambridge  Analytica  matter,  Facebook  falsely  claimed  the  company 
found  no  evidence  of  wrongdoing,  thereby  reinforcing  the  misleading  statements  in  its  periodic 
filings. 
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7.  Facebook  did  not  disclose  that  a  researcher  had  improperly  transferred  data  for 
millions  of  Facebook  users  to  Cambridge  Analytica  until  March  16,  2018,  when  the  company — 
for  the  first  time — publicly  acknowledged  on  its  website  that  it  had  learned  of  the  violation  of  its 
policy  in  2015.  The  price  of  Facebook  shares  declined  substantially  following  the  company’s 
disclosure. 

8.  Based  on  the  foregoing  conduct,  and  the  conduct  described  below,  Facebook 
violated  Sections  17(a)(2)  and  17(a)(3)  of  the  Securities  Act  of  1933  (“Securities  Act”)  and 
Section  13(a)  of  the  Securities  Exchange  Act  of  1934  (“Exchange  Act”)  and  Rules  12b-20,  13a- 
1,  13a- 13,  and  13a- 15(a)  thereunder. 

JURISDICTION  AND  VENUE 

9.  The  Commission  brings  this  action  pursuant  to  Sections  20(b),  20(d),  and  22(a) 
of  the  Securities  Act  [15  U.S.C.  §§  77t(b),  77t(d),  and  77v(a)]  and  Sections  21(d),  21(e),  and  27 
of  the  Exchange  Act  [15  U.S.C.  §§  78u(d),  78u(e),  and  78aa]. 

10.  This  Court  has  jurisdiction  over  this  action  pursuant  to  Sections  20(b),  20(d)(1) 
and  22(a)  of  the  Securities  Act  [15  U.S.C.  §§  77t(b),  77t(d)(l),  and  77v(a)]  and  Sections  21(d), 
21(e)  and  27  of  the  Exchange  Act  [15  U.S.C.  §§  78u(d),  78u(e)  and  78aa]. 

1 1 .  Defendant,  directly  or  indirectly,  made  use  of  the  means  and  instrumentalities  of 
interstate  commerce  or  of  the  mails  in  connection  with  the  acts,  transactions,  practices,  and 
courses  of  business  alleged  in  this  complaint. 

12.  Venue  is  proper  in  this  District  pursuant  to  Section  22(a)  of  the  Securities  Act 
[15  U.S.C.  §  77v(a)]  and  Section  27(a)  of  the  Exchange  Act  [15  U.S.C.  §  78aa(a)].  Acts, 
transactions,  practices,  and  courses  of  business  that  form  the  basis  for  the  violations  alleged  in 
this  complaint  occurred  in  this  District.  Facebook  employees  who  participated  in  the  events 
alleged  in  this  complaint  worked  in  the  company’s  headquarters,  which  is  located  in  Menlo  Park, 
California.  In  addition,  the  relevant  offers  and  sales  of  Facebook  securities  took  place  in  this 
District. 
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13.  Under  Rule  3-2(d)  of  the  Civil  Local  Rules,  this  civil  action  should  be  assigned  to 
the  San  Francisco  Division  because  a  substantial  part  of  the  events  or  omissions  which  give  rise 
to  the  claims  alleged  herein  occurred  in  San  Mateo  County. 

DEFENDANT 

14.  Facebook,  Inc.,  a  Delaware  corporation  based  in  Menlo  Park,  California,  is  an 
Internet  platform  that  allows  its  users  to  share  photos  and  other  digital  content  with  their 
“friends”  on-line.  Since  its  initial  public  offering  in  2012,  Facebook’s  Class  A  common  stock  has 
been  registered  under  Section  12(b)  of  the  Exchange  Act  and  trades  on  the  Nasdaq  Global  Select 
Market. 

RELEVANT  ENTITY 

15.  Cambridge  Analytica  (“Cambridge”)  was  a  data  analytics  and  advertising  firm 
affiliated  with  an  entity  in  the  United  Kingdom  known  as  the  SCL  Group.  The  firm  and  its 
affiliated  entities  filed  for  bankruptcy  protection  in  the  United  States  and  the  United  Kingdom  in 
2018.  These  organizations  are  collectively  referred  to  as  “Cambridge.” 

FACTUAL  ALLEGATIONS 
Overview  of  Facebook’s  Business 

16.  Facebook  derives  substantially  all  of  its  revenue  from  advertising  aimed  at  its 
users.  More  than  2.3  billion  people  used  the  company’s  Facebook  service  on  a  monthly  basis  in 
the  first  quarter  of  2019,  and  more  than  2.7  billion  people  regularly  used  its  broader  family  of 
services,  which  include  Facebook,  Instagram,  and  other  services.  The  company  generated  more 
than  $55.8  billion  in  revenue  in  its  2018  fiscal  year  and  had  a  market  capitalization  of  more  than 
$500  billion  as  of  March  31,  2019. 

17.  Since  it  filed  for  its  initial  public  offering  in  2012,  Facebook  has  acknowledged  in 
its  periodic  filings  with  the  Commission  that  the  size  of  its  user  base  and  level  of  its  user 
engagement  are  critical  to  its  financial  success.  Facebook  has  recognized  that  its  users’ 
willingness  to  engage  with  its  services  depends  in  part  on  users  believing  they  have  control  over 
the  way  their  data  is  shared.  The  “Risk  Factor”  disclosures  in  Facebook’s  periodic  filings  warned 


Complaint 

SEC  v.  Facebook,  Inc. 


-4- 


Securities  and  Exchange  Commission 
44  Montgomery  Street,  Suite  2800 
San  Francisco,  CA  94104  II  (415)  705-2500 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


Case  3:19-cv-04241  Document  1  Filed  07/24/19  Page  5  of  16 


investors  that  concerns  relating  to  data  privacy  and  sharing  could  result  in  Facebook  failing  to 
retain  or  add  users  or  in  users  decreasing  their  level  of  engagement,  which  could  significantly 
harm  its  business,  revenue,  and  financial  results. 

18.  One  of  the  ways  Facebook  engages  users  is  to  allow  unaffiliated  software 
developers  to  create  applications  (or  “apps”)  that  can  access  information  that  users  share  on 
Facebook.  Facebook  originally  permitted  developers  to  gather  information  from  many  app  users’ 
friends  in  addition  to  the  app  user.  Facebook  deactivated  this  pennission  in  April  2014  but 
developers  of  existing  apps  were  allowed  to  continue  to  collect  data  relating  to  an  app  user’s 
friends  until  April  2015. 

19.  Developers  who  create  Facebook  apps  must  consent  to  Facebook’s  “Platfonn 
Policy,”  a  set  of  rules  governing  what  developers  are  allowed  to  do  with  the  apps  they  create  and 
the  data  that  they  gather.  Since  at  least  2012,  the  Platfonn  Policy  has  prohibited  developers  from 
selling  user  data  or  transfening  user  data  to  anyone  who  intends  to  profit  from  the  data.  The 
Platform  Policy  is  maintained  and  updated  by  Facebook’s  policy  group,  which  works  with  others 
in  the  company  to  establish  rules  that  govern,  among  other  things,  user  privacy.  Facebook  also 
established  a  “Developer  Operations”  group  within  the  company  to  prevent  and  address 
violations  of  the  Platform  Policy. 

The  Sale  of  Facebook  Data  to  Cambridge  Analytica 

20.  In  November  2013,  an  academic  researcher  in  the  United  Kingdom  created  a 
Facebook  app  in  connection  with  his  studies.  In  doing  so,  he  agreed  to  abide  by  Facebook’s 
Platfonn  Policy.  Initially,  the  researcher  used  the  app  only  for  his  own  research. 

21.  In  January  2014,  Cambridge  approached  the  researcher  about  a  possible  business 
relationship.  Cambridge  was  exploring  a  new  model  of  election  campaigning  by  targeting 
advertising  based  on  voters’  personalities,  and  both  Cambridge  and  the  researcher  were  familiar 
with  an  academic  study  that  correlated  an  individual’s  personality  with  Facebook  “likes.” 

22.  Pursuant  to  a  June  2014  agreement  between  Cambridge  and  the  researcher,  the 
researcher  would  collect  data  from  the  users  of  his  Facebook  app  and  their  friends,  use  that 
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information  to  create  personality  “scores”  for  both  app  users  and  their  friends,  and  then  match 
these  personality  scores  to  individuals  in  Cambridge’s  U.S.  voter  database.  Cambridge  would 
provide  the  researcher  with  funding  to  help  recruit  users  to  download  and  use  the  researcher’s 
app. 

23.  The  researcher  configured  his  app  to  deliver  a  standard  academic  personality 
survey  to  app  users.  In  addition  to  the  survey  results,  the  app  obtained  the  name,  birthdate, 
gender,  location,  and  Facebook  page  likes  both  for  the  app  users  and  the  app  users’  friends. 1 

24.  In  the  summer  and  early  fall  of  2014,  a  business  entity  created  and  controlled  by 
the  researcher  retained  a  surveying  firm  to  recruit  and  pay  approximately  270,000  Facebook 
users  to  download  the  researcher’s  app  and  take  the  personality  survey.  This  enabled  the 
researcher  to  collect  Facebook  user  data  from  both  the  270,000  app  users  and  many  app  users’ 
friends,  which  collectively  amounted  to  tens  of  millions  of  Facebook  users.  From  the  survey 
responses,  the  researcher  created  personality  scores  for  all  270,000  app  users.  Then,  by  analyzing 
the  correlations  between  survey  responses  and  page  likes,  the  researcher  derived  “predicted” 
personality  scores  for  the  survey-takers’  tens  of  millions  of  friends.  The  researcher  matched  the 
personality  scores  against  Cambridge’s  database  of  American  voters  in  1 1  states,  and  transferred 
this  matched  data  back  to  Cambridge,  in  violation  of  the  Platfonn  Policy.  Cambridge  used  the 
scores  to  target  advertisements  in  connection  with  its  political  consultancy  services.  Cambridge 
paid  the  researcher’s  business  entity  for  the  costs  associated  with  the  work  done  by  the  surveying 
firm. 

25.  In  January  2015,  the  researcher  and  Cambridge  signed  a  follow-on  agreement. 
Pursuant  to  the  agreement,  Cambridge  paid  the  researcher’s  business  entity  £200,000  GBP,  and 
the  researcher,  in  violation  of  the  Platfonn  Policy,  gave  Cambridge  the  previously-collected 


1  On  Facebook,  “pages”  are  profiles  that  businesses  or  other  organizations  create  in  order  to 
have  a  presence  on  Facebook.  Organizations  use  Facebook  pages  to  share  information  about 
products,  services,  and  events.  Individuals  register  their  affinity  to  a  particular  organization  by 
“liking”  the  organization’s  Facebook  page.  “Page  likes,”  accordingly,  represent  a  set  of 
affinities  connecting  particular  individuals  to  particular  organizations. 
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names,  birthdays,  gender,  location,  personality  scores,  and  an  agreed-upon  number  of  page  likes 
for  approximately  30  million  Facebook  users  in  all  50  states.  By  the  end  of  May  2015,  the 
researcher  had  transferred  this  information  to  Cambridge. 

26.  The  researcher  also  entered  into  a  separate  agreement  with  another  entity, 
“Company  A.”  Pursuant  to  that  agreement,  the  researcher  provided  Facebook  demographic  data 
and  all  page  likes  relating  to  approximately  30  million  U.S.  Facebook  users  to  Company  A  in  the 
fall  of  2014. 

Facebook’s  Investigation  into  Cambridge  Analytical  Use  of  Facebook  Data 

27.  On  December  11,  2015,  the  British  newspaper  The  Guardian  published  an  article 
about  the  researcher  and  Cambridge  reporting  that  the  researcher  had  obtained  Facebook  data 
from  tens  of  millions  of  Facebook  users  and  used  this  data  to  create  personality  profiles  for 
Cambridge’s  use  in  American  elections. 

28.  The  newspaper  contacted  Facebook  before  publishing  its  report  and  shared  the 
allegations  they  intended  to  publish.  Facebook  provided  the  following  quote  attributable  to  a 
company  spokesperson:  “We  are  carefully  investigating  this  situation.  To  be  clear,  misleading 
people  or  misusing  their  information  is  a  direct  violation  of  our  policies  and  we  will  take  swift 
action  against  companies  that  do,  including  banning  those  companies  from  Facebook  and 
requiring  them  to  destroy  all  improperly  collected  data.”  The  Guardian  included  the  company’s 
statement  in  the  article  published  on  December  1 1,  2015. 

29.  The  day  the  Guardian  article  was  published,  a  Facebook  employee  with 
responsibility  for  interpreting  and  administering  the  company’s  Platfonn  Policy  contacted  both 
the  researcher  and  Cambridge.  Within  days,  both  the  researcher  and  Cambridge  confirmed  to 
Facebook  that  the  researcher  had  used  a  Facebook  app  to  collect  user  data  and  then  used  that  data 
to  create  personality  scores,  which  were  then  transferred  to  Cambridge. 

30.  The  Facebook  employee  concluded  that  the  researcher’s  transfer  of  personality 
scores  derived  from  Facebook  user  data  to  Cambridge  violated  the  company’s  Platform  Policy. 
This  conclusion  was  shared  with  others  in  Facebook’s  communications,  legal,  operations,  policy, 
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privacy,  and  research  groups.  The  employee  told  the  researcher  and  Cambridge  to  delete  the 
personality  scores  and  told  the  researcher  to  delete  all  of  the  Facebook  data  that  his  app  had 
collected,  and  Cambridge  subsequently  told  Facebook  that  it  had  deleted  the  data  received  from 
the  researcher. 

3 1 .  Six  months  later,  in  June  2016,  Facebook  and  the  researcher  signed  a  settlement 
agreement.  In  a  certification  attached  to  that  agreement,  the  researcher  reported — contrary  to  his 
and  Cambridge’s  representations  in  December  2015 — that,  in  addition  to  the  personality  scores, 
he  had  also  transferred  actual  U.S.  Facebook  user  data,  including  names,  birthdays,  location,  and 
certain  page  likes,  to  Cambridge.  He  also  represented  that  he  deleted  all  the  Facebook  data  his 
app  had  collected. 

32.  Almost  a  year  later,  in  April  2017,  Cambridge  provided  Facebook  with  a  similar 
certification  reporting  that  Cambridge  had  received  from  the  researcher  underlying  raw 
Facebook  user  data  in  addition  to  the  personality  scores,  as  well  as  that  it  had  deleted  that  data. 

33.  All  told,  more  than  30  Facebook  employees  in  different  corporate  groups 
including  senior  managers  in  Facebook’s  communications,  legal,  operations,  policy,  and  privacy 
groups,  learned  that  the  researcher  had  transferred  information  to  Cambridge  in  violation  of 
Facebook’s  Platfonn  Policy.  However,  as  discussed  more  fully  below,  Facebook  had  no  specific 
policies  or  procedures  in  place  to  assess  or  analyze  this  information  for  the  purposes  of  making 
accurate  disclosures  in  Facebook’s  periodic  filings. 

Red  Flags  Raised  About  Cambridge  Analytica  ’s  Other  Potential  Misuse  of  User  Data 

34.  At  the  time  of  the  December  2015  Guardian  article,  Facebook  was  already 
familiar  with  Cambridge  and  had  suspicions  that  Cambridge  had  misused  user  data.  In 
September  2015,  employees  in  Facebook’s  political  advertising  group  requested  an  investigation 
into  possible  “scraping” — the  automated  and  unauthorized  aggregation  of  Facebook  user  data — 
by  Cambridge.  After  the  Guardian  article  was  published  in  December  2015,  these  employees 
reiterated  their  concern  about  scraping.  The  political  advertising  employees  recognized 
Cambridge  as  a  well-known  firm  within  the  political  advertising  space  and  a  client  of  Facebook’s 
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advertising  business,  and  had  described  it  as  a  “sketchy  (to  say  the  least)  data  modeling  company 
that  has  penetrated  our  market  deeply.” 

35.  Throughout  2016,  red  flags  were  raised  to  Facebook  suggesting  that  Cambridge 
was  potentially  misusing  Facebook  user  data.  Following  the  Guardian  article,  several  Facebook 
employees  became  aware  of  media  reports  on  Cambridge’s  use  of  personality  profiles  to  target 
advertising  in  the  summer  and  fall  of  2016.  Facebook  lawyers  and  employees  in  the  company’s 
political  advertising  group  saw  and  discussed  an  October  27,  2016,  article  in  The  Washington 
Post  reporting  that  Cambridge  combined  psychological  tests  with  “likes”  on  “social-media  sites.” 
Employees  responsible  for  coordinating  Facebook’s  response  to  the  Guardian  article  also 
circulated  a  link  to  a  video  of  a  marketing  presentation  by  Cambridge’s  chief  executive  officer 
about  the  firm’s  ability  to  target  voters  based  on  personality.  As  an  additional  indication  to 
Facebook  that  Cambridge  might  have  been  misusing  Facebook  user  data,  some  employees  on 
Facebook’s  political  advertising  team  knew  from  August  2016  through  November  2016  that 
Cambridge  named  Facebook  and  Instagram  advertising  audiences  by  personality  trait  for  certain 
clients  that  included  advocacy  groups,  a  commercial  enterprise,  and  a  political  action  committee. 

36.  Despite  Facebook’s  suspicions  about  Cambridge  and  the  red  flags  raised  after  the 
Guardian  article,  Facebook  did  not  consider  how  this  information  should  have  informed  the  risk 
disclosures  in  its  periodic  filings  about  the  possible  misuse  of  user  data. 

Facebook’s  Misleading  Public  Filings 

37.  Since  the  time  of  its  initial  public  offering  in  20 12,  Facebook  has  warned 
investors  about  the  potential  for  misuse  of  its  users’  data  by  developers  and  the  possible 
consequent  financial  effect  on  the  company’s  business.  For  example,  in  the  Risk  Factor 
disclosures  in  its  Fonn  10-Q  filed  on  October  30,  2014,  Facebook  cautioned  that  “Improper 
access  to  or  disclosure  of  user  information,  or  violation  of  our  terms  of  service  or  policies,  could 
harm  our  reputation  and  adversely  affect  our  business.”  In  the  same  Form  10-Q,  the  company 
advised  that  if  developers  “fail  to  comply  with  our  terms  and  policies  .  .  .  our  users’  data  may  be 
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improperly  accessed  or  disclosed.”  This,  the  company  acknowledged,  “could  have  a  material  and 
adverse  effect  on  our  business,  reputation,  or  financial  results.” 

38.  Facebook  modified  this  language  beginning  in  January  2015  and  continued  to 
warn  investors  about  the  possibility  that  third  parties  might  improperly  access  or  misuse  its  users’ 
data.  For  example,  in  its  Form  10-K  filed  on  January  28,  2016,  only  weeks  after  it  had  confirmed 
that  the  researcher  had  improperly  transferred  personality  scores  derived  from  Facebook  user 
data  to  Cambridge  in  violation  of  its  Platform  Policy,  Facebook  cautioned  that  “Any  failure  to 
prevent  or  mitigate  security  breaches  and  improper  access  to  or  disclosure  of  our  data  or  user 
data  could  result  in  the  loss  or  misuse  of  such  data,  which  could  harm  our  business  and 
reputation  and  diminish  our  competitive  position.”  The  company  further  asserted  that  if 
“developers  fail  to  adopt  or  adhere  to  adequate  data  security  practices  .  .  .  our  data  or  our  users’ 
data  may  be  improperly  accessed,  used,  or  disclosed.”2 

39.  During  the  relevant  period,  Facebook’s  Risk  Factor  disclosures  misleadingly 
suggested  that  the  company  faced  merely  the  risk  of  such  misuse  and  any  harm  to  its  business 
that  might  flow  from  such  an  incident.  This  hypothetical  phrasing,  repeated  in  each  of  its 
periodic  filings  during  the  relevant  period,  created  the  false  impression  that  Facebook  had  not 
suffered  a  significant  episode  of  misuse  of  user  data  by  a  developer. 

40.  The  company’s  processes  and  procedures  around  the  drafting  of  its  periodic 
reports  on  Forms  10-K  and  10-Q,  including  but  not  limited  to  its  Risk  Factor  disclosures,  failed 
to  bring  the  researcher’s  sale  of  data  from  tens  of  millions  of  Facebook  users  to  Cambridge  to  the 
attention  of  the  individuals  with  primary  responsibility  for  drafting  and  approving  those  reports. 
Although  protecting  user  data  is  critical  to  Facebook’s  business,  and  Facebook  had  identified  the 
potential  for  improper  access  to  and  misuse  of  user  data  as  a  significant  risk,  Facebook  did  not 


2  During  the  relevant  period,  Facebook  filed  three  annual  reports  on  Fonn  10-K  for  the  fiscal 
years  ended  December  3 1,  2015,  December  31,  2016,  and  December  31,  2017,  and  six 
quarterly  reports  on  Form  10-Q  for  each  fiscal  quarter  in  2016  and  2017. 
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maintain  disclosure  controls  and  procedures  designed  to  analyze  or  assess  incidents  involving 
misuse  of  user  data  for  potential  disclosure  in  the  company’s  periodic  filings. 

4 1 .  During  the  relevant  period,  Facebook  identified  trends  and  events  for  possible 
disclosure  through  a  series  of  quarterly  meetings  to  prepare  for  the  company’s  earnings 
announcements.  This  process  relied  on  the  employees  and  managers  who  attended  these 
meetings  to  identify  issues  that  might  need  to  be  disclosed.  Although  several  employees  in 
Facebook’s  legal,  policy,  and  communications  groups  who  attended  these  meetings  during  the 
relevant  period  were  aware  of  the  researcher’s  improper  transfer  of  data  to  Cambridge,  that 
incident  was  never  discussed.  Facebook  also  did  not  share  information  regarding  the  incident 
with  its  independent  auditors  and  outside  disclosure  counsel  in  order  to  assess  the  company’s 
disclosure  obligations. 

42.  Facebook  had  no  specific  mechanism  to  summarize  or  report  violations  of  its 
Platform  Policy  to  employees  responsible  for  ensuring  the  accuracy  of  Facebook’s  filings  with 
the  Commission.  For  example,  the  Facebook  employees  responsible  for  monitoring  violations  of 
the  company’s  Platform  Policy  were  not  provided  with  the  draft  disclosures  pertaining  to  the 
misuse  of  user  data. 

43.  Asa  result,  Facebook  senior  management  and  relevant  legal  staff  did  not  assess 
the  scope,  business  impact,  or  legal  implications  of  the  researcher’s  improper  transfer  of  data  to 
Cambridge,  including  whether  or  how  it  should  have  been  disclosed  in  Facebook’s  public  filings 
or  whether  it  rendered,  or  would  render,  any  statements  made  by  the  company  in  its  public  filings 
misleading. 

44.  Based  on  the  foregoing,  Facebook  filed  materially  misleading  periodic  reports 
with  the  Commission.  Facebook  knew,  or  should  have  known,  that  its  Risk  Factor  disclosures  in 
its  annual  reports  on  Fonn  1 0-K  for  the  fiscal  years  ended  December  3 1 ,  20 1 5,  December  3 1 , 
2016,  and  December  31,  2017,  and  in  its  quarterly  reports  on  Form  10-Q  filed  in  2016  and  2017, 
as  incorporated  into  its  Form  S-8  registration  statements,  were  materially  misleading. 
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45.  The  Risk  Factor  disclosures  were  incorporated  by  reference  into  Facebook’s 
registration  statements  on  Forms  S-8  filed  with  the  Commission  on  May  21,  2012  and 
February  1,  2013.  These  statements  registered  sales  of  shares  of  Facebook  common  stock  under 
the  company’s  employee  and  officer  equity  incentive  plans,  and  incorporated  future  periodic 
reports  filed  with  the  Commission,  including  those  filed  during  the  relevant  period. 

46.  During  the  relevant  period,  Facebook  received  approximately  $29  million  in  cash 
proceeds  from  the  exercise  of  employee  stock  options.  Facebook  also  granted  restricted  stock 
units  to  more  than  17,000  new  employees  during  the  relevant  period  who,  in  some  cases,  agreed 
to  accept  lower  salaries  in  exchange  for  additional  equity  compensation. 

Facebook’s  Statements  to  the  Press  Reinforced  Its  Misleading  Filings 

47.  Beginning  in  November  2016,  reporters  asked  Facebook  about  the  investigation 
that  the  company  said  it  was  conducting  in  the  December  2015  Guardian  article.  These  inquiries 
were  referred  to  Facebook’s  communications  group,  which  was  aware  that  the  company  had 
confirmed  that  the  researcher  had  improperly  transferred  personality  profiles  based  on  U.S.  user 
data  to  Cambridge  in  violation  of  Facebook’s  policy,  and  had  told  both  parties  to  delete  the  data. 

48.  The  communications  group  initially  responded  to  the  press  inquiries  indirectly. 
For  example,  beginning  in  February  2017,  the  communications  group  pointed  reporters  to 
Cambridge’s  public  statement  that  it  “does  not  use  data  from  Facebook”  and  “does  not  obtain 
data  from  Facebook  profiles  or  Facebook  likes.”  This  was  misleading  because  it  suggested  that 
Facebook  was  unaware  that  Cambridge  had  improperly  obtained  Facebook  user  data. 

49.  On  at  least  two  subsequent  occasions  in  March  2017,  Facebook’s 
communications  group  provided  the  following  quote  to  reporters:  “Our  investigation  to  date  has 
not  uncovered  anything  that  suggests  wrongdoing.”  This  was  misleading  because  Facebook  had, 
in  fact,  determined  that  the  researcher’s  transfer  of  user  data  to  Cambridge  violated  the 
company’s  Platfonn  Policy.  The  quote  served  to  reinforce  the  misleading  impression  in 
Facebook’s  periodic  filings  that  the  company  was  not  aware  of  any  material  developer  misuse  of 
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user  data.  The  on-line  publication  The  Intercept  included  the  quote,  attributed  to  a  Facebook 
spokesperson,  in  an  article  dated  March  30,  2017. 

Facebook’s  Acknowledgement  of  the  Cambridge  Analytica  Incident 

50.  In  March  20 1 8,  The  New  York  Times  and  Guardian  contacted  Facebook  and 
informed  the  company  that  the  publications  planned  to  run  stories  about  the  researcher’s 
improper  transfer  of  data  to  Cambridge,  including  that  Facebook  had  told  the  researcher  and 
Cambridge  to  delete  their  Facebook  data.  Reporters  from  the  Times  suggested  that  Cambridge 
had  not  deleted  the  data,  contrary  to  its  representations  to  Facebook. 

5 1 .  After  the  close  of  market  on  Friday,  March  16,  2018,  Facebook  preempted  the 
newspapers’  publication  by  a  post  on  its  own  online  Facebook  “newsroom.”  The  company 
publicly  acknowledged,  for  the  first  time,  that  it  had  confirmed  that  the  researcher  had  transferred 
user  data  to  Cambridge,  in  violation  of  its  Platform  Policy,  and  that  the  company  had  told  the 
researcher  and  Cambridge  to  delete  the  data  in  December  2015.  When  the  market  opened  on 
Monday,  March  19,  2018,  the  price  of  Facebook’s  shares  fell  five  percent,  from  $185.09  to 
$172.56,  and  continued  to  decline  throughout  the  week,  closing  at  $159.39  per  share  on 

March  23,  2018. 

FIRST  CLAIM  FOR  RELIEF 

Violations  of  Sections  17(a)(2)  and  (3)  of  the  Securities  Act 

52.  The  Commission  re-alleges  and  incorporates  by  reference  Paragraph  Nos.  1 
through  51,  above. 

53.  By  engaging  in  the  conduct  described  above,  Defendant  Facebook,  directly  or 
indirectly,  in  the  offer  or  sale  of  securities,  by  use  of  the  means  or  instruments  of  transportation 
or  communication  in  interstate  commerce  or  by  use  of  the  mails, 

( 1 )  obtained  money  or  property  by  means  of  untrue  statements  of  material  fact  or  by 

omitting  to  state  a  material  fact  necessary  in  order  to  make  the  statements  made, 
in  light  of  the  circumstances  under  which  they  were  made,  not  misleading;  and 
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(2)  engaged  in  transactions,  practices,  or  courses  of  business  which  operated  or 
would  operate  as  a  fraud  or  deceit  upon  purchasers. 

54.  By  reason  of  the  foregoing,  Defendant  violated,  and  unless  restrained  and 
enjoined  will  continue  to  violate,  Section  17(a)  (2)  and  Section  17(a)(3)  of  the  Securities  Act 
[15  U.S.C.  §§  77q(a)(2)  and  77q(a)(3)]. 

SECOND  CLAIM  FOR  RELIEF 
Violations  of  Section  13(a)  of  the  Exchange  Act  and 
Rules  12b-20,  13a-l  and  13a-13  Thereunder 

55.  The  Commission  re-alleges  and  incorporates  by  reference  Paragraph  Nos.  1 
through  51,  above. 

56.  Defendant  has  at  all  relevant  times  been  an  issuer  that  has  a  class  of  securities 
registered  pursuant  to  Section  12  of  the  Exchange  Act  [15  U.S.C.  §  78/]. 

57.  As  described  above,  Defendant’s  filings  with  the  Commission,  including  its 
reports  filed  on  Forms  10-K  and  Forms  10-Q,  reflected  misleading  statements  concerning  the 
improper  access  to  and  misuse  of  its  users’  personal  information. 

58.  Based  on  the  conduct  alleged  above,  Defendant  violated,  and  unless  restrained 
and  enjoined  will  continue  to  violate,  Section  13(a)  of  the  Exchange  Act  [15  U.S.C.  §  78m(a)] 
and  Rules  12b-20,  13a-l,  and  1 3 a- 1 3  thereunder  [17  C.F.R.  §§  240.12b-20,  240.13a-l,  and 
240. 13a-13],  which  obligate  issuers  of  securities  registered  pursuant  to  Section  12  of  the 
Exchange  Act  [15  U.S.C.  §  78/]  to  file  with  the  Commission  periodic  reports  with  information 
that  is  accurate  and  not  misleading. 

THIRD  CLAIM  FOR  RELIEF 
Violations  of  Rule  13  a- 15(a)  of  the  Exchange  Act 

59.  The  Commission  re-alleges  and  incorporates  by  reference  Paragraph  Nos.  1 
through  51,  above. 

60.  Defendant  failed  to  maintain  controls  and  procedures  designed  to  ensure  that 
information  required  to  be  disclosed  in  the  reports  that  it  files  or  submits  pursuant  to  the 
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Exchange  Act  is  recorded,  processed,  summarized,  and  reported,  within  the  time  periods 
specified  in  the  Commission’s  rules  and  forms. 

61 .  Defendant  also  failed  to  maintain  controls  and  procedures  designed  to  ensure  that 
information  required  to  be  disclosed  in  the  reports  that  it  files  or  submits  pursuant  to  the 
Exchange  Act  is  accumulated  and  communicated  to  its  management,  including  its  principal 
executive  and  principal  financial  officers,  or  persons  performing  similar  functions,  as  appropriate 
to  allow  timely  decisions  regarding  required  disclosure. 

62.  By  reason  of  the  foregoing,  Defendant  violated  Rule  13a-15(a)  of  the  Exchange 
Act  [17  C.F.R.  §  240. 13 a- 15(a)]. 

PRAYER  FOR  RELIEF 

WHEREFORE,  the  Commission  respectfully  requests  that  this  Court: 

I. 

Permanently  enjoin  Defendant  Facebook  from  directly  or  indirectly  violating 
Sections  17(a)(2)  and  17(a)(3)  of  the  Securities  Act  [15  U.S.C.  §§  77q(a)(2)  and  77q(a)(3)],  and 
Section  13(a)  of  the  Exchange  Act  [15  U.S.C.  §  78m(a)],  and  Rules  12b-20,  13a- 1 ,  13a-13, 
and  13a-15(a)  [17  C.F.R.  §§  240.12b-20,  240.13a-l,  240.13a-13,  and  240.13a-15(a)]  thereunder. 

II. 

Issue  an  order  requiring  Defendant  Facebook  to  pay  a  civil  monetary  penalty  pursuant  to 
Section  20(d)  of  the  Securities  Act  [15  U.S.C.  §  77t(d)]  and  Section  21(d)  of  the  Exchange  Act 
[15  U.S.C.  §  78u(d)(3)]. 

III. 

Retain  jurisdiction  of  this  action  in  accordance  with  the  principles  of  equity  and  the 
Federal  Rules  of  Civil  Procedure  in  order  to  implement  and  carry  out  the  terms  of  all  orders  and 
decrees  that  may  be  entered,  or  to  entertain  any  suitable  application  or  motion  for  additional 
relief  within  the  jurisdiction  of  this  Court. 
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IV. 

Grant  such  other  and  further  relief  as  this  Court  may  determine  to  be  just  and  necessary. 


Dated:  July  19,  2019 


Respectfully  submitted, 


/s/ Matthew  G.  Meverhofer _ 

Matthew  G.  Meyerhofer 
Attorney  for  Plaintiff 

SECURITIES  AND  EXCHANGE  COMMISSION 
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